Who’s Watching AI? The Visibility Gap Security Teams Need to Close

AI adoption isn't waiting for security teams.

Employees are experimenting with new tools. Business leaders are pushing teams to use AI to work faster. Applications are adding AI functionality. AI agents are accessing files, connecting to tools, and taking action as if they were employees.

This has tremendous potential.

But there's also a fundamental cybersecurity problem: Do you know what AI is doing inside your organization, or is it becoming a growing blind spot in AI visibility?

That's the question at the center of a new episode of Cybercrime: From the Frontline, Who’s Watching AI? Managing Innovation Without Losing Control.

Watch or listen to the full conversation to hear Bitdefender experts explore how organizations can embrace AI innovation while managing its risks.

How Many Organizations Lack Full AI Visibility?

The 2026 Bitdefender Cybersecurity Assessment reveals that 44.8% of IT and cybersecurity professionals have only partial visibility into employee AI use. Another roughly 3% report having no visibility at all.

The independent research surveyed 1,200 IT and cybersecurity professionals across six countries and shows how widespread the lack of AI visibility and control has become. And the challenge is growing because employees have powerful incentives to experiment. AI can accelerate development, automate repetitive work, analyze information, and help meet increasingly aggressive productivity expectations.

Has Shadow IT Become Shadow AI?

Shadow AI introduces similar challenges to Shadow IT, but with potentially greater consequences.

With Shadow IT, an employee installs an unauthorized application. A department adopts a cloud service without consulting IT. Someone stores corporate information in a personal file-sharing account.

With Shadow AI, an employee might use a personal AI account instead of an approved enterprise platform. Someone could paste confidential information into a free AI service. An approved application might gain new AI capabilities through an update.

In each case, sensitive information could move somewhere security teams didn't anticipate. That's particularly concerning given that data leakage into large language models ranks among the leading AI-related concerns identified in the 2026 Cybersecurity Assessment.

According to experts on the podcast episode, AI adoption often happens without IT or security oversight, making visibility an enterprise-wide responsibility.

Why Is AI Becoming an Identity Problem?

Traditional generative AI responds to requests. Agentic AI can interact with tools, access files, connect to services, write code, and take actions. During the podcast, our experts suggest thinking about these agents as non-human identities operating inside the organization.

That raises important questions:

• Which agents are operating in your environment?
• What data can they access?
• Which tools can they use?
• What actions are they permitted to take?
• And what happens if an agent is manipulated?

The podcast also explores prompt injection, where malicious instructions embedded within content can influence an AI system into performing unintended actions. If an agent has access to corporate systems, the question isn't simply whether you trust the AI.

What Does AI Visibility Look Like Today?

A simple inventory isn't enough. To achieve AI visibility, organizations must be able to identify the AI services and agents operating across their environments. Security teams need context on those tools, including their capabilities, permissions, connections, potential risks, and the endpoints they affect.

They also need to distinguish sanctioned AI use from unknown or potentially dangerous activity. Without that understanding, organizations risk applying blanket restrictions that frustrate employees or overlooking exposures that genuinely threaten the business.

Visibility provides the foundation for prioritizing risk and applying appropriate controls.

What Kinds of Tools Create AI Visibility and Control?

Organizations increasingly need specialized capabilities that discover AI usage, assess exposure, and translate security policies into action. One example is Bitdefender GravityZone AI Visibility and Control, which helps security teams identify more than 700 AI tools, including chatbots, coding assistants, local LLMs, agents, MCP servers, and AI-enabled applications. It creates a centralized inventory and helps prioritize findings based on risk and business context.

Importantly, GravityZone goes beyond discovery. Security teams can review and investigate findings, then use integrated controls to allow, restrict, or block AI activity. For existing GravityZone customers, these capabilities operate through the same agent and console, helping organizations manage AI exposure without adding another disconnected security tool.

How Can AI Governance Keep Pace With AI Adoption?

Technology is part of the answer, but AI governance must also become part of acceptable-use policies, employee education, procurement reviews, third-party risk assessments, and conversations between security and business leaders.

Some organizations are establishing dedicated AI steering committees. Others are incorporating AI into existing security and risk governance. The structure matters less than the outcome: security needs to participate in AI adoption decisions before deploying new tools.

Can Organizations Innovate Without Losing Control?

According to the podcast episode's experts, organizations can continue AI innovation without losing control, but only with a sound strategy. Instead of putting the brakes on AI adoption, organizations should make approved AI easier to use safely, educate employees about the risks of unsanctioned tools, use technology to track where sensitive information moves, and establish controls based on actual usage.

As AI agents become more capable, organizations must also understand and constrain agent permissions, just as they would for human identities.

Together, these measures can help make AI innovation sustainable.

For the complete discussion:

Listen to Cybercrime: From the Frontline, Who’s Watching AI? Managing Innovation Without Losing Control.

Or watch the full episode here: